Splunk IT Service Intelligence
Highlighted

ITSI - An unknown view name "search" is referenced in the navigation definition for "itsi" - View customization

Communicator

Hello,

I am trying to remove some views from the app, so that the simple users can only see dashboards. To do that I have created a new user with Role = "userreadonly" (created by me with capabilities inherit by Role = "user"), then from Settings >> User Interface >> Views I have removed the read permission to the following views for "userreadonly" and "user":

  • Search
  • Datasets
  • Reports
  • Alerts

And then in Settings >> User Interface >> Navigation Menu, modified the xml to have the Dashboards view as default.
So that the result is the following (only Dashboards menu is showed):

alt text

Until now everthing was working as per the expectation, but this simple user should also access to ITSI application.
For this reason I added "itoauser" and "useraduser" to the "userread_only" Role.
When Clicking in the ITSI link from App menu the page crash:

alt text

So doing a search in the index="_internal" with the given request ID, it shows several errors like:

An unknown view name "search" is referenced in the navigation definition for "itsi"
source =    /opt/splunk/var/log/splunk/web_service.log
sourcetype =    splunk_web_service

Do you know if there is a way to remove the Search view from my app and do not let ITSI crash with the above error message?

Thanks a lot,
Edoardo

0 Karma